DARK READING
Indonesia Hit by Android Banking App-Cloning Campaign
The GoldFactory threat group exploits the Android Work Profile feature to deliver the Gigabud Trojan, while Mantax Otax spreads separately.
By Dark Reading
CVE-2026-16310: MemberDash Plugin Lets Unauthenticated Attackers Reset Any WordPress User Password
A critical IDOR in the MemberDash WordPress plugin (versions up to 1.8.5) lets unauthenticated attackers take over any account, including admins, silently.
CVE-2026-75816: WordPress Plugin Auth Bypass Lets Attackers Hijack Admin Accounts
A missing ownership check in Frontend Admin by DynamiApps lets unauthenticated attackers overwrite any WordPress user's email and trigger a password reset.
CVE-2026-85148: Hardcoded Credentials in SmartIT Desktop Manager Allow Remote Access
A hardcoded password in Lightstar's SmartIT Desktop Manager lets unauthenticated attackers remotely access user hosts with no credentials required.
CVE-2026-85695: FastChat's /register_worker Endpoint Has No Auth Gate
An unauthenticated attacker can register arbitrary workers in FastChat, hijack model traffic, and probe internal network ports via SSRF.
🇨🇦
IAM in Canada
Regulation, innovation & incidents across the True North[ FEATURED IMAGE ]
Federal PolicyTreasury Board Mandates Phishing-Resistant MFA Across All Federal Departments by Q4 2026
The new directive requires all Government of Canada systems to implement FIDO2-compliant authentication, phasing out SMS-based MFA.
Privacy
Bill C-27 AIDA Amendments Add Identity Verification Requirements for AI Systems
Provincial
Ontario Digital Identity Program Expands to Include Healthcare Provider Credentialing
Breach
Alberta Municipality Confirms Active Directory Compromise Affecting 45K Citizen Records
Industry
Canadian Banks Pilot Shared KYC Identity Network Using Verified Credentials
🇨🇦 Regulatory & Compliance Tracker
PIPEDA / Bill C-27
● Amendments in Senate Review
OSFI B-13 Guideline
● Active - Enforced
Quebec Law 25
● Fully In Effect
Pan-Canadian Trust Framework
● v2.0 Under Consultation
CSE ITSP.30.031
● Updated March 2026
Last reviewed: May 10, 2026
🚨 Oops... Another One
Live breach and vulnerability intelligence - updated as it happens
Breach Intelligence
● LIVECRITICAL32m ago
MedVault Health Systems - 2.3M Records
Misconfigured SCIM provisioning endpoint exposed patient identity data.
CRITICAL2h ago
NordikPay - 890K OAuth Tokens Leaked
Exposed refresh tokens allowed unauthorized access to customer financial accounts.
HIGH4h ago
TeleCom Asia - Employee Directory Breach
LDAP injection attack exposed 340K employee records including AD credentials.
HIGH6h ago
EduConnect - Student SSO Compromise
Federated SAML assertion replay attack affected 45 university systems.
MEDIUM8h ago
RetailMax - Loyalty Program Credential Stuffing
Automated attack compromised 120K accounts using previously breached credentials.
Vulnerability Tracker
● LIVE9.81h ago8.73h ago7.55h ago7.27h ago5.49h ago
CVE-2026-31847 - FortiAuthenticator RCE
Unauthenticated remote code execution via crafted RADIUS authentication packet.
CVE-2026-28391 - Okta OIDC Token Bypass
Token validation flaw allows authentication bypass in specific OIDC flow configurations.
CVE-2026-29104 - PingFederate XXE
XML External Entity injection in SAML metadata parser allows SSRF.
CVE-2026-30582 - Azure AD B2C Policy Injection
Custom policy XML injection allows privilege escalation in B2C tenants.
CVE-2026-31205 - Keycloak Session Fixation
Session token not rotated after authentication in specific broker flows.
Never Miss a Breach, CVE, or Industry Shift
Join thousands of IAM professionals getting the weekly Intelligence Brief every Monday morning.